Metaverse Security: The Attacks Businesses Expect as They Move Into Virtual Worlds

Virtual worlds promise a lot to companies and to the people who use them. In the metaverse a person can meet others, go to work, shop, play games, attend a concert or take a trip, all without stepping outside the house. Like every technology still taking shape, though, it brings new risks with it, and security is near the top of the list.

Tenable put the question to 1,500 IT, DevSecOps and other security specialists, and the answers show how worried they are about data protection once business moves into virtual space. The threats they describe run from deepfakes that copy a person's voice and face to the familiar phishing campaign. Taken together, the findings paint a bleak picture of what organisations could run into as they enter this new digital environment.

Companies are moving faster than their defences

Security teams have been rushing to catch up with a fast-growing market, and the result is that a good number of businesses are not properly covered against threats that keep changing. According to the Tenable poll, 68% of businesses intend to run some form of metaverse operation in the next 6 to 36 months, and 23% have already started building projects. Concern is still high. For 41% of those surveyed, cybersecurity was the single biggest factor shaping how their company invests in the metaverse.

Four threats respondents consider likely

The survey singled out four areas that organisations entering virtual worlds are most anxious about:

1. Impersonation through avatars. Some 79% think it very or somewhat likely that attackers will clone voices and facial features, or use avatars to hijack video recordings, inside the metaverse.

2. Eavesdropping by invisible avatars. So-called 'man in the room' attacks were rated very or somewhat likely by 78%, who put this down to weaknesses in VR software.

3. Old threats in a new place. A total of 81% expect the phishing, malware and ransomware attacks companies already deal with to carry over into other metaverses.

4. Machine identities and APIs. Roughly four in five (78%) see compromised machine identities and API transactions across metaverses as either extremely likely or moderately possible.

Building protection before building the virtual office

The recommended starting point is that a company should put a complete cybersecurity framework in place before it faces these threats. It suggests four measures:

1. Insider threats in virtual worlds. Set clear policies and procedures for who can access which data, and teach employees what insider threats look like.

2. Malware and phishing. Add defensive tools such as firewalls and antivirus software, and train staff to spot these attacks and stop them.

3. Identity theft and fraud. Use multi-factor authentication and other strong authentication methods to keep users' personal details safe and block fraud.

4. Virtual assets. Encryption, access controls and similar measures help prevent theft and other unauthorised activity.

Tenable, which sponsored the piece, sells cybersecurity products covering areas from vulnerability management through to endpoint security, and positions them as a way for organisations to secure their metaverse operations.